Cybersecurity Awareness Month, week 4: Does your team know how to report a suspicious email?
During Cybersecurity Awareness Month, we are focusing on one practical action each week that small businesses can take to improve their security.
We started with multifactor authentication for business email, followed by testing a file restore from backup. Last week, we focused on checking software updates across the business.
This week, set aside 10 minutes to walk your team through a suspicious email and show them exactly how to report it.
An employee should know who to contact, what information to provide, and what to do if they have already clicked something.
Start with the request in the email
Phishing messages try to get someone to take an action that benefits the attacker, such as entering a password, opening a harmful attachment, or sharing sensitive information. They can resemble messages employees receive as part of their normal work.
For this week's discussion, use examples relevant to your business:
- An unexpected invoice asking an employee to open an attachment.
- A sign-in notice claiming that email access will be suspended.
- A document-sharing message that leads to an unfamiliar login page.
- A vendor asking you to send the next payment to a different bank account.
Look at what the sender wants the employee to do. Were they expecting the message? Does the request fit the usual process? Is someone pressuring them to act before they can verify it?
CISA's guidance for businesses identifies unexpected requests, urgent language, and suspicious links as warning signs. It also notes that messages can come from known contacts whose accounts have been compromised. A familiar name alone does not establish that the request is legitimate.
Verify requests through a known contact method
If an email requests a payment change, pause the payment and contact the vendor using a phone number already in your records. Do not use a new number supplied in the same email.
The FBI recommends using a secondary channel to verify requests for changes in account information with the intended recipient. Make this part of your payment process even when the request looks ordinary.
For an unexpected account warning, open the service through your usual bookmark or application. You can also contact your IT provider through its established support channel. CISA recommends using a known contact method when checking a message that appears to come from someone you know, rather than replying or using a phone number or link in the message.
Employees should have permission to pause a request while they verify it, including requests that appear to come from the owner.
This week's action
Choose a screenshot or a made-up example with no working links or attachments. Ask your IT provider for a safe training example if you need one.
Spend 10 minutes reviewing it together:
- Identify what the message asks the recipient to do.
- Discuss what would need verification before acting.
- Show the exact reporting method employees should use.
- Explain what changes if someone has already clicked or entered information.
Keep the discussion open. Ask employees to explain their next step rather than guessing whether the message is a test.
If someone says, "I would ask a coworker," follow up with how the message would reach the person responsible for investigating it. If someone says, "I would delete it," show them how to report it first using your business's approved process.
Make reporting specific
"Tell IT" needs a name, number, or reporting button attached to it.
Before the discussion, confirm the process with your IT provider. Your business might use an email reporting button, a support address, or a phone number. Have the provider demonstrate the process in the email application your employees actually use.
Confirm who receives the report and who checks it. Also give employees a backup contact for times when the primary person is unavailable.
Put those instructions somewhere staff can find quickly. A short internal note could include the approved reporting method, the urgent contact number, and what to do after an accidental click.
Tell employees that they can report a message when they are unsure. They should not have to investigate it themselves or prove that it is malicious before asking for help.
If someone already clicked
Ask employees to stop interacting with the message or website and contact your IT provider immediately. Microsoft advises contacting IT when a phishing incident involves a work computer.
They should explain what happened: whether they opened an attachment, entered a password, approved a sign-in prompt, shared information, or sent a payment. Include the approximate time and the device they were using. They should never send their password as part of the report.
If a password was entered, work with IT immediately to change it through the legitimate service and review the affected account. If money was sent, contact the bank immediately as well. The FBI's business email compromise guidance calls for contacting the financial institution as soon as the fraud is discovered.
Make prompt reporting an explicit expectation, and thank employees for speaking up. Save the discussion about how to prevent a repeat for after the immediate issue has been addressed.
What to have by the end of the week
Your team should have reviewed one safe example, practiced the reporting process, and received clear contact instructions. Assign someone to keep those instructions current and include them when a new employee joins.
Keep a brief record of the discussion, including the date, who participated, and any gaps you need to resolve.
Finish with this question:
If an employee received a suspicious email today, would they know who to contact and what to do next?
Sources
- CISA, Teach Employees to Avoid Phishing: warning signs, compromised known contacts, independent verification, and clear reporting procedures.
- FBI/IC3, Business Email Compromise (BEC): verifying account changes through secondary channels and contacting the bank immediately after fraud.
- Microsoft, How to protect against phishing attacks: reporting work-device incidents to IT and changing affected account passwords.